freedombone-utils-firewall 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Firewall functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2016 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. function save_firewall_settings {
  31. iptables-save > /etc/firewall.conf
  32. ip6tables-save > /etc/firewall6.conf
  33. printf '#!/bin/sh\n' > /etc/network/if-up.d/iptables
  34. printf 'iptables-restore < /etc/firewall.conf\n' >> /etc/network/if-up.d/iptables
  35. printf 'ip6tables-restore < /etc/firewall6.conf\n' >> /etc/network/if-up.d/iptables
  36. chmod +x /etc/network/if-up.d/iptables
  37. }
  38. function enable_ipv6 {
  39. # endure that ipv6 is enabled and can route
  40. sed -i 's/net.ipv6.conf.all.disable_ipv6.*/net.ipv6.conf.all.disable_ipv6 = 0/g' /etc/sysctl.conf
  41. #sed -i "s/net.ipv6.conf.all.accept_redirects.*/net.ipv6.conf.all.accept_redirects = 1/g" /etc/sysctl.conf
  42. #sed -i "s/net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 1/g" /etc/sysctl.conf
  43. sed -i "s/net.ipv6.conf.all.forwarding.*/net.ipv6.conf.all.forwarding=1/g" /etc/sysctl.conf
  44. echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  45. }
  46. function configure_firewall {
  47. if grep -q "RELATED" /etc/firewall.conf; then
  48. # recreate the firewall to remove RELATED
  49. sed -i "/firewall/d" $COMPLETION_FILE
  50. fi
  51. if grep -Fxq "configure_firewall" $COMPLETION_FILE; then
  52. return
  53. fi
  54. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  55. # docker does its own firewalling
  56. return
  57. fi
  58. iptables -P INPUT ACCEPT
  59. ip6tables -P INPUT ACCEPT
  60. iptables -F
  61. ip6tables -F
  62. iptables -t nat -F
  63. ip6tables -t nat -F
  64. iptables -X
  65. ip6tables -X
  66. iptables -P INPUT DROP
  67. ip6tables -P INPUT DROP
  68. iptables -A INPUT -i lo -j ACCEPT
  69. iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
  70. # Make sure incoming tcp connections are SYN packets
  71. iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  72. # Drop packets with incoming fragments
  73. iptables -A INPUT -f -j DROP
  74. # Drop bogons
  75. iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
  76. iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
  77. iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  78. # Incoming malformed NULL packets:
  79. iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
  80. echo 'configure_firewall' >> $COMPLETION_FILE
  81. }
  82. function configure_firewall_ping {
  83. if grep -Fxq "configure_firewall_ping" $COMPLETION_FILE; then
  84. return
  85. fi
  86. # Only allow ping for mesh installs
  87. if [[ $SYSTEM_TYPE != "$VARIANT_MESH" ]]; then
  88. return
  89. fi
  90. iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  91. iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
  92. function_check save_firewall_settings
  93. save_firewall_settings
  94. echo 'configure_firewall_ping' >> $COMPLETION_FILE
  95. }
  96. function configure_firewall_for_avahi {
  97. if grep -Fxq "configure_firewall_for_avahi" $COMPLETION_FILE; then
  98. return
  99. fi
  100. iptables -A INPUT -p tcp --dport 548 -j ACCEPT
  101. iptables -A INPUT -p udp --dport 548 -j ACCEPT
  102. iptables -A INPUT -p tcp --dport 5353 -j ACCEPT
  103. iptables -A INPUT -p udp --dport 5353 -j ACCEPT
  104. iptables -A INPUT -p tcp --dport 5354 -j ACCEPT
  105. iptables -A INPUT -p udp --dport 5354 -j ACCEPT
  106. function_check save_firewall_settings
  107. save_firewall_settings
  108. echo 'configure_firewall_for_avahi' >> $COMPLETION_FILE
  109. }
  110. function configure_firewall_for_dns {
  111. if grep -Fxq "configure_firewall_for_dns" $COMPLETION_FILE; then
  112. return
  113. fi
  114. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  115. # docker does its own firewalling
  116. return
  117. fi
  118. iptables -A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
  119. function_check save_firewall_settings
  120. save_firewall_settings
  121. echo 'configure_firewall_for_dns' >> $COMPLETION_FILE
  122. }
  123. function configure_firewall_for_web_access {
  124. if grep -Fxq "configure_firewall_for_web_access" $COMPLETION_FILE; then
  125. return
  126. fi
  127. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  128. # docker does its own firewalling
  129. return
  130. fi
  131. if [[ $ONION_ONLY != "no" ]]; then
  132. return
  133. fi
  134. iptables -A INPUT -p tcp --dport 32768:61000 --sport 80 -j ACCEPT
  135. iptables -A INPUT -p tcp --dport 32768:61000 --sport 443 -j ACCEPT
  136. function_check save_firewall_settings
  137. save_firewall_settings
  138. echo 'configure_firewall_for_web_access' >> $COMPLETION_FILE
  139. }
  140. function configure_firewall_for_web_server {
  141. if grep -Fxq "configure_firewall_for_web_server" $COMPLETION_FILE; then
  142. return
  143. fi
  144. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  145. # docker does its own firewalling
  146. return
  147. fi
  148. if [[ $ONION_ONLY != "no" ]]; then
  149. return
  150. fi
  151. iptables -A INPUT -p tcp --dport 80 -j ACCEPT
  152. iptables -A INPUT -p tcp --dport 443 -j ACCEPT
  153. function_check save_firewall_settings
  154. save_firewall_settings
  155. OPEN_PORTS+=('HTTP 80')
  156. OPEN_PORTS+=('HTTPS 443')
  157. echo 'configure_firewall_for_web_server' >> $COMPLETION_FILE
  158. }
  159. function configure_firewall_for_ssh {
  160. if grep -Fxq "configure_firewall_for_ssh" $COMPLETION_FILE; then
  161. return
  162. fi
  163. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  164. # docker does its own firewalling
  165. return
  166. fi
  167. iptables -A INPUT -p tcp --dport 22 -j ACCEPT
  168. iptables -A INPUT -p tcp --dport $SSH_PORT -j ACCEPT
  169. function_check save_firewall_settings
  170. save_firewall_settings
  171. OPEN_PORTS+=("SSH $SSH_PORT")
  172. echo 'configure_firewall_for_ssh' >> $COMPLETION_FILE
  173. }
  174. function configure_firewall_for_git {
  175. if grep -Fxq "configure_firewall_for_git" $COMPLETION_FILE; then
  176. return
  177. fi
  178. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  179. # docker does its own firewalling
  180. return
  181. fi
  182. if [[ $ONION_ONLY != "no" ]]; then
  183. return
  184. fi
  185. iptables -A INPUT -p tcp --dport 9418 -j ACCEPT
  186. function_check save_firewall_settings
  187. save_firewall_settings
  188. OPEN_PORTS+=("Git 9418")
  189. echo 'configure_firewall_for_git' >> $COMPLETION_FILE
  190. }
  191. function configure_internet_protocol {
  192. if grep -Fxq "configure_internet_protocol" $COMPLETION_FILE; then
  193. return
  194. fi
  195. if [[ $SYSTEM_TYPE == "$VARIANT_MESH" ]]; then
  196. return
  197. fi
  198. sed -i "s/#net.ipv4.tcp_syncookies=1/net.ipv4.tcp_syncookies=1/g" /etc/sysctl.conf
  199. sed -i "s/#net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  200. sed -i "s/#net.ipv6.conf.all.accept_redirects = 0/net.ipv6.conf.all.accept_redirects = 0/g" /etc/sysctl.conf
  201. sed -i "s/#net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 0/g" /etc/sysctl.conf
  202. sed -i "s/#net.ipv4.conf.all.accept_source_route = 0/net.ipv4.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  203. sed -i "s/#net.ipv6.conf.all.accept_source_route = 0/net.ipv6.conf.all.accept_source_route = 0/g" /etc/sysctl.conf
  204. sed -i "s/#net.ipv4.conf.default.rp_filter=1/net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
  205. sed -i "s/#net.ipv4.conf.all.rp_filter=1/net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
  206. sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=0/g" /etc/sysctl.conf
  207. sed -i "s/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=0/g" /etc/sysctl.conf
  208. if ! grep -q "ignore pings" /etc/sysctl.conf; then
  209. echo '# ignore pings' >> /etc/sysctl.conf
  210. echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  211. echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
  212. fi
  213. if ! grep -q "disable ipv6" /etc/sysctl.conf; then
  214. echo '# disable ipv6' >> /etc/sysctl.conf
  215. echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
  216. fi
  217. if ! grep -q "net.ipv4.tcp_synack_retries" /etc/sysctl.conf; then
  218. echo 'net.ipv4.tcp_synack_retries = 2' >> /etc/sysctl.conf
  219. echo 'net.ipv4.tcp_syn_retries = 1' >> /etc/sysctl.conf
  220. fi
  221. if ! grep -q "keepalive" /etc/sysctl.conf; then
  222. echo '# keepalive' >> /etc/sysctl.conf
  223. echo 'net.ipv4.tcp_keepalive_probes = 9' >> /etc/sysctl.conf
  224. echo 'net.ipv4.tcp_keepalive_intvl = 75' >> /etc/sysctl.conf
  225. echo 'net.ipv4.tcp_keepalive_time = 7200' >> /etc/sysctl.conf
  226. fi
  227. echo 'configure_internet_protocol' >> $COMPLETION_FILE
  228. }
  229. function mesh_firewall {
  230. FIREWALL_FILENAME=${rootdir}/etc/systemd/system/meshfirewall.service
  231. MESH_FIREWALL_SCRIPT=${rootdir}/usr/bin/mesh-firewall
  232. echo '#!/bin/bash' > $MESH_FIREWALL_SCRIPT
  233. echo 'iptables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
  234. echo 'ip6tables -P INPUT ACCEPT' >> $MESH_FIREWALL_SCRIPT
  235. echo 'iptables -F' >> $MESH_FIREWALL_SCRIPT
  236. echo 'ip6tables -F' >> $MESH_FIREWALL_SCRIPT
  237. echo 'iptables -t nat -F' >> $MESH_FIREWALL_SCRIPT
  238. echo 'ip6tables -t nat -F' >> $MESH_FIREWALL_SCRIPT
  239. echo 'iptables -X' >> $MESH_FIREWALL_SCRIPT
  240. echo 'ip6tables -X' >> $MESH_FIREWALL_SCRIPT
  241. echo 'iptables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
  242. echo 'ip6tables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT
  243. echo 'iptables -A INPUT -i lo -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
  244. echo 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT' >> $MESH_FIREWALL_SCRIPT
  245. echo '' >> $MESH_FIREWALL_SCRIPT
  246. echo '# Make sure incoming tcp connections are SYN packets' >> $MESH_FIREWALL_SCRIPT
  247. echo 'iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP' >> $MESH_FIREWALL_SCRIPT
  248. echo '' >> $MESH_FIREWALL_SCRIPT
  249. echo '# Drop packets with incoming fragments' >> $MESH_FIREWALL_SCRIPT
  250. echo 'iptables -A INPUT -f -j DROP' >> $MESH_FIREWALL_SCRIPT
  251. echo '' >> $MESH_FIREWALL_SCRIPT
  252. echo '# Drop bogons' >> $MESH_FIREWALL_SCRIPT
  253. echo 'iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP' >> $MESH_FIREWALL_SCRIPT
  254. echo 'iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
  255. echo 'iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP' >> $MESH_FIREWALL_SCRIPT
  256. echo '' >> $MESH_FIREWALL_SCRIPT
  257. echo '# Incoming malformed NULL packets:' >> $MESH_FIREWALL_SCRIPT
  258. echo 'iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP' >> $MESH_FIREWALL_SCRIPT
  259. echo '' >> $MESH_FIREWALL_SCRIPT
  260. echo "iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  261. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  262. echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  263. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  264. echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  265. echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport 1900 -j ACCEPT" >> $MESH_FIREWALL_SCRIPT
  266. chmod +x $MESH_FIREWALL_SCRIPT
  267. echo '[Unit]' > $FIREWALL_FILENAME
  268. echo 'Description=Mesh Firewall' >> $FIREWALL_FILENAME
  269. echo '' >> $FIREWALL_FILENAME
  270. echo '[Service]' >> $FIREWALL_FILENAME
  271. echo 'Type=oneshot' >> $FIREWALL_FILENAME
  272. echo 'ExecStart=/usr/bin/mesh-firewall' >> $FIREWALL_FILENAME
  273. echo 'RemainAfterExit=no' >> $FIREWALL_FILENAME
  274. echo '' >> $FIREWALL_FILENAME
  275. echo 'TimeoutSec=30' >> $FIREWALL_FILENAME
  276. echo '' >> $FIREWALL_FILENAME
  277. echo '[Install]' >> $FIREWALL_FILENAME
  278. echo 'WantedBy=multi-user.target' >> $FIREWALL_FILENAME
  279. chroot "$rootdir" systemctl enable meshfirewall
  280. }